Elastic and OpenAI are expanding their partnership. Elasticsearch will serve as a context layer for OpenAI models, enabling companies to build production-ready AI agents. The focus is on three areas: context-aware agents, agentic observability, and agentic security operations.
OpenAI provides the reasoning, while Elastic provides the retrieval, governance, and operational data layer. Much business knowledge is hidden in unstructured data: documents, tickets, logs, metrics, and security alerts.
Elastic combines lexical and vector search, semantic reranking, filters, and access control into a single platform. In internal tests, the company achieved 0.89 recall with full data protection per user.
In an experiment on the BrowseComp-Plus dataset, the pre-computed Knowledge Indicators reduced input token usage by up to 75% compared to a standard RAG baseline. Accuracy increased from 60 to 92 percent.
Security and observability
Within Elastic Security, Attack Discovery uses OpenAI models to correlate individual alerts into coherent attack chains linked to MITRE ATT&CK. According to Elastic, Visa reduced the triage time for mainframe detections from 10 to 20 minutes to just seconds. Airtel reports up to 40 percent faster triage.
Elastic is also participating in the OpenAI Daybreak Cyber Partner Program to integrate GPT-5.5 Cyber models. For SRE teams, the company is expanding agent-based investigation capabilities, including through the upcoming general availability of Knowledge Indicators.
Tip: Elastic is launching Agent Builder to build AI agents faster