- Elastic and OpenAI expanded their partnership on July 30, 2026, integrating OpenAI models with Elasticsearch as the retrieval and governance layer for enterprise AI agents.
- Elastic’s Knowledge Indicators cut input token usage by up to 75% and lifted answer accuracy from 60% to 92% in internal benchmarks, according to the company, figures that would materially change agent deployment unit economics if they hold in production.
- Visa and Airtel deployments show Elastic Security with OpenAI models reduced mainframe detection triage from 10-20 minutes to seconds, and cut triage time by up to 40% respectively, per Elastic’s published case studies.
Most enterprise AI agents fail not because the underlying model is weak, but because it has no governed path to the data it needs. That’s the gap Elastic and OpenAI are targeting: positioning Elasticsearch as the retrieval, permissioning and governance layer between OpenAI’s reasoning models and the unstructured data that sits in most enterprise environments.
The Context Problem
Documents, logs, tickets and metrics accumulate inside organisations with no structured retrieval layer connecting them to inference. Elastic calls this “context debt.” The integration pairs OpenAI’s reasoning models with Elasticsearch’s lexical and vector search, access controls and permission filters, so agents retrieve only what a given user is authorised to see.
The architecture targets enterprises where data governance is non-negotiable. How widely this maps onto existing Elastic deployments in practice is harder to verify from the announcement alone, but the combination of retrieval and permissioning at the data layer addresses a gap that RAG-based enterprise knowledge systems have struggled with since deployment moved beyond pilot scale.
Token Economics
Elastic reports its precomputed Knowledge Indicators cut input token consumption by up to 75% compared to a standard RAG baseline, while lifting answer accuracy from 60% to 92%, in internal experiments. The company has not cited independent validation of these figures.
For teams running high-volume agent pipelines, token spend scales directly with retrieval volume. A 75% reduction in input tokens, if it holds across production workloads, would substantially change the unit economics of agent deployment, the kind of cost shift that moves a use case from marginal to viable.
Security Operations
Elastic Security now runs on OpenAI models. The figures cited below come from Elastic’s published case studies.
At Visa, mainframe detection triage dropped from 10-20 minutes to seconds. At Airtel, triage time fell by up to 40%. Both results are consistent with the pattern seen in managed AI agent deployments in enterprise workflows where the largest gains come from collapsing analyst review time rather than from model accuracy alone.
Agent Observability
Elastic Observability now ingests agent-specific data types alongside traditional telemetry. Prompts, tool calls, model responses, token usage and retrieval steps appear in the same platform as logs, metrics and traces. SRE teams can correlate AI application signals with infrastructure telemetry in a single view, compressing the diagnostic loop when agent behaviour degrades. Elastic Workflows and Agent Builder are available to automate remediation once root cause is identified.
Governance and Compliance
Upcoming support for OpenAI’s enterprise logging features will give teams an auditable record across OpenAI workspaces: API key lifecycles, role assignments, configuration changes and signals of suspicious behaviour. Unaudited API activity across a large workspace is a liability surface that has received growing scrutiny in enterprise SaaS deals and the logging layer is the mechanism that closes it.
Agent Builder
Elastic’s Agent Builder reached general availability in February 2026 with Elastic 9.3. It lets developers build agents that query Elasticsearch data directly and call defined tools, with Elastic Workflows and Skills handling orchestration. The design target is the gap between prototype agents and production-grade deployments, where agents need persistent context, permission-aware retrieval and responses grounded in current enterprise data rather than model training weights.
The bet is structural: retrieval, governance and agent tooling in one stack, keeping the data layer, the permissions layer and the agent layer from fragmenting across vendors. It is the same logic behind SAP’s multi-agent architecture where integration depth across layers matters more than any individual component.
