Elastic certification path

Credential Type: Practical hands-on exam (90 minutes, performance-based)
Focus Areas: Elasticsearch cluster operations, data indexing, search relevance, Kibana visualization, basic performance tuning

What's tested:

• Elasticsearch cluster architecture and deployment models
• Index management, mapping design, and field analysis
• Search queries, filtering, and aggregations
• Kibana dashboards, visualizations, and alerting
• Data ingestion with Logstash and Beats
• Basic cluster tuning and troubleshooting

Study timeline:

• Week 1-2: Elasticsearch core concepts, architecture
• Week 3-4: Index and mapping deep dive, hands-on lab clusters
• Week 5-8: Search queries, Kibana, real-world scenarios
• Week 9-12: Practice exams, cluster performance optimization

Credential Type: Practical hands-on exam (90 minutes, security-focused scenarios)
Focus Areas: SIEM use cases, threat detection, security analytics, Kibana alerting, data correlation for investigations

What's tested:

• Elastic SIEM architecture and rule creation
• Detection engineering and threat hunting workflows
• Risk analysis and compliance reporting
• Incident response with Elastic Security
• Data correlation for multi-step attack detection
• Alert tuning and false-positive reduction

Study timeline:

• Week 1-2: SIEM concepts, Elastic Security fundamentals
• Week 3-4: Detection rules, Kibana alerting mechanics
• Week 5-8: Threat hunting scenarios, real-world SIEM data
• Week 9-12: Incident response workflows, compliance mapping

Path 1: Search & Observability Engineer (12 months)

Target roles: Platform Engineer, Elasticsearch Engineer, Observability Architect
Career peak: Senior Staff Engineer or Elasticsearch Team Lead ($180K-$220K USD)

Monthly milestones:

• Month 1-2: Deploy single-node and multi-node clusters, understand shard allocation
• Month 3: Complete ECE hands-on labs, master Kibana discovery
• Month 4: Pass ECE exam, receive Elastic Certified Engineer badge
• Month 5-7: Study advanced search algorithms, implement custom analyzers
• Month 8-10: Deploy Elastic Cloud, master IaC (Terraform/Helm)
• Month 11-12: Lead architecture decisions, mentor junior engineers

Key competencies gained:

• Elasticsearch cluster design and scaling (10K-1M+ documents/day)
• Relevance tuning and custom scoring strategies
• Observability architecture with APM, metrics, logs
• Kubernetes deployments and Elastic Cloud operations
• Query optimization and index lifecycle management

Path 2: Security Analyst / Threat Hunter (12 months)

Target roles: SIEM Analyst, Threat Hunter, Security Operations Engineer
Career peak: Senior Threat Hunter or CISO (security side) ($160K-$220K USD)

Monthly milestones:

• Month 1-2: Study network protocols, malware analysis, attack frameworks
• Month 3: Complete ECA hands-on labs, understand Elastic detection rules
• Month 4: Pass ECA exam, receive Elastic Certified Analyst badge
• Month 5-7: Build custom detection rules, practice threat hunting
• Month 8-10: Integrate threat intelligence feeds, automate incident workflows
• Month 11-12: Lead threat hunts, mentor SOC analysts, advise on SIEM architecture

Key competencies gained:

• Detection rule writing (YARA, KQL, machine learning rules)
• Threat hunting workflows and frameworks (MITRE ATT&CK)
• Incident response coordination and evidence preservation
• SIEM deployment and tuning for enterprise environments
• Compliance reporting (PCI-DSS, HIPAA, SOC 2) with Elastic

Sequencing constraints:

• Both paths benefit from strong Linux fundamentals (Month 0)
• ECE can be attempted independently; ECA practitioners often complete ECE first
• Path 1 enables Path 2 (Observability engineers can pivot to security)
• Choose early: Security vs. Platform engineering mindset determines learning focus

Elastic Certified Engineers often transition to or from competing platforms. Understanding the ecosystem bridges competencies across vendors.

Key bridge points:

Exam & Certification Costs

USD Costs:

ZAR Costs (at 18:1 exchange rate per SARB):

Lab & Learning Infrastructure (optional)

Demand & Salaries (2026 Q2)

Elasticsearch/Elastic engineer roles:

• US market: 2,800+ active postings (LinkedIn, Indeed, Glassdoor)
• EU market: 1,200+ active postings
• APAC market: 600+ active postings
• YoY growth: +18% (2024-2026)

SIEM analyst/threat hunter roles:

• US market: 2,200+ active postings
• EU market: 900+ active postings
• APAC market: 500+ active postings
• YoY growth: +22% (2024-2026, security talent shortage)

Salary ranges by experience (USD / ZAR):

USD Salary Growth (ECE Path)

ZAR Salary Growth (ECE Path — at 18:1 rate)

Notes:

• Y1 assumes junior role post-certification
• Y2-Y3 reflects mid-level engineer with project leadership
• Y5-Y7 reflects senior/staff engineer in major metros (SF, NYC, London)
• Y10 reflects principal engineer or security director trajectory
• ZAR calculations use SARB exchange rate of 18:1 (2026 Q1 reference)
• Regional variations: US salaries 20-40% higher than EU; EU 30-50% higher than APAC

Q1: Do I need ECE before taking ECA?
A: No. They are independent credentials. However, ECE provides foundational Elasticsearch knowledge that eases ECA study. Many security professionals skip ECE and go directly to ECA (3-4 weeks additional study time). Platform engineers typically follow ECE → advanced specialization.

Q2: How much hands-on lab time is required?
A: Minimum 40-60 hours for ECE, 35-50 hours for ECA. Both exams are performance-based (not multiple-choice), so lab work is essential. Elastic provides free sandbox environments and official training courses ($50-$200 on Udemy/A Cloud Guru).

Q3: Is the exam proctored? Can I take it remotely?
A: Yes. Elastic exams are delivered by Pearson VUE with remote proctoring. You need a quiet space, webcam, and stable internet. Exam window is 90 minutes for both ECE and ECA.

Q4: What's the pass rate and how many attempts do most people need?
A: Unofficial data suggests ~65-75% first-attempt pass rates. Most candidates prepare for 3-6 months. Retakes cost $200 USD (R3,600 ZAR) each. Budget 2 attempts if you're unfamiliar with hands-on labs.

Q5: Does Elastic offer training courses?
A: Yes. Elastic University provides instructor-led (remote/in-person) and self-paced courses ($300-$1,500). Recommended courses: "Getting Started with Elasticsearch" (ECE prep) and "SIEM & Detection Engineering" (ECA prep). Many are included with Elastic Cloud subscriptions.

Q6: Are these certifications recognized outside North America?
A: Yes. Elastic certifications are recognized globally by enterprises using the Elastic Stack. APAC and EU markets value ECE/ECA nearly as much as US market. However, Splunk certifications remain more recognized in some legacy-heavy organizations.

• Elastic Certification Overview: https://www.elastic.co/training/certification
• Elastic Training & Learning: https://www.elastic.co/training/
• Credly Badge Verification: https://www.credly.com/organizations/elastic/badges
• Elastic Documentation: https://www.elastic.co/guide/
• Elasticsearch Hands-on Labs: https://www.elastic.co/training/
• Elastic Community & Forums: https://discuss.elastic.co/
• Elastic University Courses: https://www.elastic.co/training/courses/
• Pearson VUE Exam Registration: https://www.pearsonvue.com/

• Last verified: 2026-05-02
• Data sources: Elastic.co official sites, Credly badge registry, LinkedIn job market data, salary aggregators (Glassdoor, Levels.fyi, Payscale)
• Exchange rate: USD to ZAR at 18:1 (SARB reference rate, 2026 Q1)
• Job posting counts: Aggregated from LinkedIn, Indeed, Glassdoor (US-focused; other regions extrapolated)
• Salary data: Based on US market (Bay Area, NYC, remote senior roles); ZAR conversions are directional for South African context
• Certification exam details: Updated to 2025-2026 format (performance-based, 90-minute window)
• Career growth projections: Based on typical staff engineer progressions at 150+ employee tech companies

This roadmap is a living document. Elastic frequently updates exam objectives, adds certifications, and adjusts pricing. Verify current details at https://www.elastic.co/training/certification before enrolling.