Case analytics indices
Elastic mirrors your case data into dedicated analytics indices that are built for reporting and aggregation. This page describes those indices and how often they refresh. To let users report on this data, grant access to the case analytics indices.
Elasticsearch automatically creates three analytics indices and keeps them in sync with your case data:
| Index | What it holds | Example |
|---|---|---|
.cases |
One document per case, with each case's current details | Status, severity, assignees, and timing metrics |
.cases-activity |
One document per action taken on a case | A status change, severity change, or comment |
.cases-attachments |
One document per item attached to a case | An alert, comment, file, dashboard, or visualization |
The .cases-activity and .cases-attachments indices join back to .cases on the case.id field.
These indices store status and severity as readable text and precalculate common timing metrics like time to resolve. They hold data from Elastic Security, Observability, and Stack Management together, so use the owner and space_id fields to filter by solution or space.
Field names use the singular case.* form, such as case.status. A plural path like cases.status isn't a valid field, and the ES|QL query fails.
For the fields available in each index, refer to Case analytics field reference.
Elasticsearch automatically creates the analytics indices for you, so you don't need to create them or manage their lifecycle policies. It creates a separate set of indices for each solution in every space that has cases.
Elasticsearch names each index .internal.<type>.<solution>-<space-name>, with a matching alias that drops the .internal prefix. For example, Security case attachments in the default space use the index .internal.cases-attachments.securitysolution-default and the alias .cases-attachments.securitysolution-default.
Combine a type and a solution to build the name for the data you want:
<type> |
Contents |
|---|---|
cases |
General case data |
cases-comments |
Case comments |
cases-attachments |
Case attachments |
cases-activity |
Case activity |
| Solution | <solution> |
|---|---|
| Stack Management | cases |
| Observability | observability |
| Security | securitysolution |
In Elastic Stack 9.2.x-9.4.x, fields are unprefixed. For example, use status and time_to_resolve, not case.status. This differs from 9.5 and later, where fields use the case.* prefix.
For schema details, refer to Case analytics indices schema.
Case analytics keeps your data current in two ways:
- It updates the indices as soon as you create, edit, or delete a case.
- As a backup, a background task checks for recently changed cases on a regular schedule (about every 30 minutes) and fills in anything the immediate update missed.
Because updates take a moment to apply, a new or edited case can take a short time to appear in your queries.
A background task refreshes the analytics indices every five minutes with a snapshot of the most current case data. During each refresh, Elasticsearch overwrites the historical case data.
- After you create a case, indexing the new case data can take up to 10 minutes.
- After you create a space, the case analytics indices for that space can take up to an hour to form.