Keep in mind that X-Pack is itself little more than plugin-ins for the OSS version of the Elastic Stack. In fact, it wasn’t that long ago that X-Pack was installed using
elasticsearch-plugin install x-pack. Releasing plugins that “compete” with X-Pack is not anything different than what has long been available from SearchGuard and ReadonlyREST (security), ElastAlert (alerting), Sentinl (alerting & reporting), and more.
Elastic made the move to “pre-bundle” X-Pack when they made X-Pack open code. Similarly AWS also “pre-bundles” their plugins with the OSS foundation of Elasticsearch and Kibana. I would not consider this to be a fork. It is a distribution.
Of course there is some risk of Elastic changing their plugin APIs in the future to limit such competitive options. Such a move might force a fork down the road. Hopefully it won’t come to that.
X-Pack is a well integrated offering that includes additional features like Machine Learning (well… anomaly detection for time series data) and Canvas. Perhaps even more important to risk-averse enterprises, X-Pack customers have the ability to pick up the phone and dial for support directly from the source.
There is however another group of users, who can live with support from the community, and need little more than some basic security options to get all they need from the stack. For this group, Open Distro fits the bill. And there is some comfort knowing that it is backed by significant tech powerhouses like AWS and Netflix (not sure if Netflix is a backer or just a user).
Will this hurt Elastic a bit? Sure. Security is the #1 driver of X-Pack sales, forcing even small organizations to bite the bullet and buy a subscription. Afterall, security is like car insurance… none of us really want to spend money on it… but for production environments we have no choice. Open Distro has the potential to cost them a significant portion of this segment of customers, as well as some larger organizations who have enough in-house know-how to live without support.
I have no issue with the fact that Elastic sells value-added features for a premium. If they can’t make money, their stack wouldn’t be where it is today, and a lot of organizations/users would be worse off. However moves like making the Grok Debugger part of X-Pack (especially when the original is still available here) make it clear that there is more behind their X-Pack strategy than offering premium features.
I have to wonder whether Open Distro ever happens if Elastic would have given the OSS release basic login capability, and focused their commercial efforts on major value-adding options. However now that both exist, and arguably appeal to different user segments, I hope they are able to thrive together for the good of the community.