Per Cluster, Not Per Node: How Search Guard Licensing Works
CMO
Per Cluster, Not Per Node: How Search Guard Licensing Works
Part 1 of 3 in our series on licensing and cost. Part 2 (10 Nov) looks at the cost lines in an Elasticsearch security setup. Part 3 (17 Nov) covers how to start for free.
Budget season is here. Somewhere this month, someone in your team is filling in a spreadsheet row called "Elasticsearch" and trying to guess what next year's cluster will look like.
That guess is the hard part. Clusters grow. A new product line ships logs, a data team adds a use case, retention goes from 30 days to 90 because an auditor asked. If your security licence is tied to the size of the cluster, every one of those decisions turns into a budget question.
Search Guard is licensed differently, and this is the first of three short articles on how and why.
One licence per production cluster
Search Guard is licensed per production cluster. One licence covers one cluster that serves live workloads, with as many nodes as that cluster needs.
Grow from 3 nodes to 300, and the licence cost stays the same. Add memory, add storage, add data nodes for a new use case: none of it changes what you pay for Search Guard.
Dev, staging and QA are included
Every production cluster has a supporting cast. Development systems, a staging environment, test and QA clusters. With Search Guard, all of them are covered by the production licence they support, at no extra cost.
That matters more than it sounds. Test environments are where teams try upgrades, rehearse configuration changes and reproduce problems. When they cost extra, they tend to get smaller, older or skipped. When they are included, you can run them the way they should be run: as close to production as possible.
Disaster-recovery clusters and other special setups are handled case by case. Ask, and we will find a sensible arrangement.
What that means for your 2027 budget
For the spreadsheet row, it comes down to one question: how many production clusters will you run next year?
That number tends to be stable. Node counts change every quarter. Cluster counts change when the architecture changes, and those are decisions you plan for anyway.
There is also nothing to meter. No node counting, no resource tracking, no true-up at renewal. The figure you budget in November is the figure you pay.
Three editions, one model
The same model applies to every edition:
Community Edition:
free forever under Apache 2.0, including commercial production use. Essential security (TLS, role-based access control, internal users) plus full Signals alerting. Unlimited nodes, unlimited clusters.Enterprise Edition:
adds SAML, OpenID Connect, LDAP and Active Directory, Kerberos, document- and field-level security, Kibana multi-tenancy, audit logging and SLA-based support.Compliance Edition:
everything in Enterprise, plus tooling for GDPR, HIPAA, SOX and ISO, and read-access tracking for sensitive data.Academic, non-profit and OEM licences are available as well.
Try it before you budget it
Every Enterprise and Compliance feature is free for 60 days. Download, install, and the trial licence activates on its own: no registration, no licence key, no credit card. When the trial ends, nothing breaks. Your cluster keeps running, and you decide whether to licence the features you used.
If you already know your cluster count, tell us and you will have a quote within one business day. No calls unless you want one.
Next in this series, Tue 10 Nov: what you are really paying for. The cost lines in an Elasticsearch security setup, and which of them move when your cluster grows.
Published: 2026-11-03
Summarize this with AI
Questions? Drop us a line!
Other posts you may like
The True Cost of an Elasticsearch Security Incident: 5 Mistakes That Can Turn Into a Breach
Daniel Gleim || 2026-10-13
In this article, we look at five common Elasticsearch security mistakes and the real costs organizations face when security gaps are left unaddressed.
read more
Fast-Tracking Compliance in Elasticsearch Using Search Guard
Daniel Gleim || 2026-06-11
Search Guard provides security and compliance features directly inside the Elastic stack-configurable, integrated, and designed for regulated environments.
read more
Cybernation Berlin 2026
Anja Glauch || 2026-06-01
Search Guard macht Elasticsearch-Cluster prüfungssicher: vom Login bis zur Verschlüsselung. Treffen Sie uns auf der Cybernation 2026 in Berlin.
read more
