Working with Elastic Support

Best Practices


As the most common and frequent of activities, here are the best practices related to open support cases with Elastic.

What is a case?

A case can go by many names: ticket, service request, incident, problem, issue, etc. As far as we're concerned, they all mean the same thing. We generally use the term "case" because that's what our support system provider calls them.

A case (or whatever term you prefer to use) can represent many different kinds of situations you'll encounter as a customer:

  1. You found a bug in one of our products.
  2. You would like a new feature considered.
  3. You have a question about how to do something with our products.
  4. You need to make some changes to your account (e.g., add or remove a user).
  5. You need to give us a heads up about some maintenance you'll be doing over the weekend that might result in a new case.

All of these situations (and likely some we've missed) are valid case topics.

When should I open a case?

Now that we're on the same page about what a case is, let's talk about when to open one.

Your subscription level matters. Currently, we offer four types of subscriptions: Development, Silver, Gold, and Platinum. Only Silver has a limitation on the number of cases that can be opened (we call them "incidents" in the contract) and channels of support (e.g., email, web). Development has a limitation on the type of cases that can be opened - namely, only development-related issues, as opposed to production issues. For reference, please see for a full definition of our subscription packages. Please keep the Development and Silver caveats in mind as we dive into the details of opening a case below.

Generally speaking, you should open a case for anything important to you. It's just that simple. Cases are the way we communicate with each other a majority of the time, and we want to be well connected with you as a customer to ensure your success as well as our own. If in doubt, open a case to open the discussion.

Here's a handy chart to help you understand what kind of response times you should expect per subscription level. More on the definition of each level in the next section.

Subscription Urgent (Level 1) High (Level 2) Normal (Level 3) Dev Support
Platinum 1 hour 24x7 4 hours 24x7 1 business day 1 business day
Gold 4 business hours 1 business day 2 business days 2 business days
Silver 1 business day 2 business days 4 business days 4 business days
Development - - - 2 business days

Note: Business hours are defined by your company location in your support contract.

How do I open a case?

This is pretty straightforward. When your company's account was created as part of our order processing, each person you identified as an authorized support contact to your Sales Representative received an individual login. Notification of this new login is made via email to the person's email address provided by your company. Within this notification is a link to set the person's initial password and login to the system. Once that first step is complete and the login is verified, these instructions apply to all logins.

  1. Login to our support system at
  2. Search our Knowledge Base for any known issues
  3. If nothing matches your issue, click "Submit a Request" from the menu along the top.
  4. Fill in the resulting form (see "What should I say in my case?" section below for more info).
  5. Click "Submit."

You will then receive an email from our system letting you know your case was created, and all future conversation can occur through email.

What should I say in my case?

We understand that sometimes problems related to software like ours can be complicated, and it can be difficult (even daunting) to get everything related to the problem into that small text box every support system offers you. However, the more information you can provide us the better we'll be able to grasp what we call The Three S's: Situation, Severity, and Seriousness.

Situation: The more straightforward you can be in your description of what problem you're experiencing, with as many observable symptoms as you can and as many artifacts as you can upload, the better we can determine how similar or dissimilar the problem you're telling us about looks like other problems we've seen. The faster we can make this match, the faster we can resolve your problem. And the faster we fail a match, the faster we can bring the right specialist resources into the discussion - again also making for faster resolution.

Severity: We offer 4 severity levels: Urgent (1), High (2), Normal (3), and Dev Support (4).

Note: Severities 1-3 only apply to production levels of support - Silver, Gold, Platinum.

We have fairly standard definitions for what these mean:

  • Urgent: Production is down, your business has stopped, drop everything now and help you.
  • High: Production is wounded, but still functioning. You aren't sure if it's fatal, send help as quickly as possible.
  • Normal: Production seems fine, but you have questions (this is usually the default).
  • Development: Specifically designated for non-production cases. Not time sensitive.

Picking the right severity is important, but even more important is giving us a simple clear description of the impact the problem you're reporting is having on you. Impact is different than symptoms, as some symptoms appear very mild in words but, when combined with something else going on in your environment, can be deadly. When setting the severity, take an extra moment in your description to tell us about the impact.

Seriousness: How serious a problem is depends on many factors, but ultimately only you can tell us how the situation and severity combine to affect your business. Sometimes seriousness is non-technical, in that a dashboard used by your executive team is performing poorly, which on the surface might sound like a situation of normal to high severity, but this changes when we learn that dashboard is about to be made public to your customers. Suddenly this is serious, because not only is our reputation on the line with you, your reputation is on the line with your own customers. We like to understand how a problem fits within the bigger context of your business, which helps us prioritize our response beyond just what the situation and severity tells us.

Now that I've opened a case, what happens next?

We have attempted to make working with us as easy as possible, but as with any support organization it's important as a customer to understand a little about what happens behind the scenes to make for the best experience possible. Once you've opened your case, a lot of automation we've built goes to work to make sure we are consistently delivering high-quality support. It goes a little something like this:

  1. We assign your case to your lead Elastic engineer. Your lead engineer is notified of your case. No more wondering if there are actual humans on the other end worried about your problems — we know instantly!
  2. We analyze your case to determine if we should page our on-call resources. Generally, this is only used for after-hours coverage, but our customer-crazy executives are paged on EVERY severity 1 and 2 — your issues never go unnoticed!
  3. Based on the Three S's (Situation, Severity, and Seriousness) your lead Elastic engineer or the on-call engineer (depending on time of day) will engage with on your case within our committed response times.

The rest is pretty straightforward technical support interaction via the case, phone, or chat depending on which channel of support best suits The Three S's for that case.

How do I follow up on cases?

You have two ways to interact with us on an existing case:

  1. Login to and see all your cases either waiting on us or waiting on you.
  2. Respond to the email receipts from our system to update with your response.

There's no wrong way to interact with us. It's completely up to you and your preference.

Phone Support

We've covered opening a case, which is the most common way we communicate with customers. But sometimes you need to actually speak with a human being in real time, especially when the problem you're experiencing is either very complex and/or very time sensitive in nature. Our Development, Gold, and Platinum subscription levels all offer phone as channel of support (Silver is web-only), so in this section we'll tell you how to use it.

If my subscription level includes phone access, how do I make use of it?

If you have a Development, Gold, or Platinum subscription, you are entitled to phone access. Congratulations! To make use of this entitlement, all you have to do is ask. When opening a case (see previous topic), if a phone conversation is the best way to discuss the problem, let us know some dates/times you are available and we will schedule a call. Unless you tell us otherwise, we schedule the call using our own VoIP tool which allows for voice, video, and screen sharing.

Why can't I just call a number to reach you?

Eventually you will be able to just call us anytime, but at this stage in our company's size and scale we offer a scheduled call back service for phone support.

What about screen sharing?

Yes, we will be happy to take a look at anything that will help us resolve your question faster. The tool we use for phone conferences also allows you to share your screen with us. Just ask.

Making Use of the Community Forums

As any healthy open source project would, Elasticsearch, Logstash, and Kibana have vibrant and helpful communities. We understand you have chosen to become our customer because you want the assurance of high-quality support, single source of truth, and committed response times — and we can't thank you enough! But that doesn't mean our open source communities can't be a useful resource for you.

So, where are these communities?

Such a simple question, but a good one. The best place to start is which lists all the best community resources. The most commonly used resources are our community forums. For easy reference, they are:

Visit to explore additional forums.

Feel free to use these forums as sources of information and for general discussions. Of course, as a customer you do not need to rely on these communities for your critical or confidential support needs, and we strongly recommend against posting any time-sensitive requests here — you have us for that!

There's a Book!

In true open source fashion, Elastic engineers Clinton Gormley and Zachary Tong wrote a book about Elasticsearch totally in the open, chapter by chapter. (All grammatical faux pas should be corrected now.) The most up-to-date version of it is here:

This is a great reference and we highly recommend that each customer read it.