Case analytics field reference
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
9.5+
Generally available since 9.5
Use this page as a reference for the fields you can query in the case analytics indices when you're looking for specific case data.
Most fields use the singular case.* prefix, such as case.status, even though the index names are plural, such as .cases. A few fields, including owner, space_id, and @timestamp, sit at the top level without the case.* prefix.
Fields with the date type use ISO 8601 format, set to the server's time zone, such as 2025-07-27T14:30:00.000Z.
The .cases index holds one document per case, with the current state of each case.
| Field | Type | Description |
|---|---|---|
@timestamp |
date | When Elasticsearch last wrote this document, which tracks the case's last update. |
space_id |
keyword | The space the case belongs to. |
owner |
keyword | The solution that owns the case: securitySolution for Elastic Security, observability for Observability, or cases for Stack Management (unavailable in Serverless). |
case.id |
keyword | The case UUID. Join key for the activity and attachment indices. For more information, refer to UUID. |
case.incremental_id |
unsigned_long | The sequential case number shown in the UI. For more information, refer to numeric ID. |
| Field | Type | Description |
|---|---|---|
case.title |
text | Case title. Also indexed as case.title.keyword for aggregation and sorting. |
case.description |
text | Case description. |
case.tags |
keyword | Tags applied to the case. |
case.category |
keyword | Case category. |
case.status |
keyword | Case status: open, in-progress, or closed. |
case.severity |
keyword | Case severity: low, medium, high, or critical. |
case.assignees.uid |
keyword | Profile UIDs of the case's assignees (a case can have several), not display names. To resolve a UID to a name, look it up with the user profile API, or match it to actor.profile_uid in .cases-activity, which also carries actor.username, .full_name, and .email. The .cases-activity method only resolves users who have acted on a case. |
Timing fields store values in seconds and are null until the case reaches the corresponding state. Divide by 3600 for hours.
| Field | Type | Description |
|---|---|---|
case.created_at |
date | When the case was created. |
case.updated_at |
date | When the case was last updated. |
case.in_progress_at |
date | When the case first moved to in-progress. |
case.closed_at |
date | When the case was closed. null while the case is open. |
case.duration |
unsigned_long | Total time from open to closed, in seconds. |
case.time_to_acknowledge |
long | Time from creation to first moving to in-progress, in seconds. |
case.time_to_investigate |
long | Time from in-progress to resolution, in seconds. |
case.time_to_resolve |
long | Time from creation to resolution, in seconds. |
| Field | Type | Description |
|---|---|---|
case.created_by.username |
keyword | Username of the case creator. Also includes .email, .full_name, and .profile_uid. |
case.updated_by.username |
keyword | Username of the last editor. Also includes .email, .full_name, and .profile_uid. |
case.closed_by.username |
keyword | Username of the person who closed the case. Also includes .email, .full_name, and .profile_uid. |
| Field | Type | Description |
|---|---|---|
case.total_alerts |
integer | Number of alerts attached to the case. |
case.total_comments |
integer | Number of user comments on the case. |
case.total_events |
integer | Number of attached events. |
case.total_observables |
integer | Number of observables on the case. |
| Field | Type | Description |
|---|---|---|
case.template.id |
keyword | ID of the template applied when the case was created, if any. |
case.template.version |
integer | Version of the applied template. |
case.extended_fields |
flattened | Template field values, keyed as <name>_as_<type>. Query the keys with FIELD_EXTRACT or a terms aggregation. Refer to Analyze case fields. |
case.customFields.key |
keyword | Key of a custom field. Paired with .type and .value. |
case.customFields.type |
keyword | The custom field's type. |
case.customFields.value |
keyword | The custom field's value, with typed sub-fields .boolean, .date, .ip, .number, and .string. |
case.customFields holds a case's custom field values in raw form and is populated for current cases. Because it's a nested field, you can't query it with ES|QL. Use Query DSL nested queries and aggregations instead. For values defined by a template or the field library, use case.extended_fields, which supports ES|QL and typed fields. Refer to Analyze case fields.
| Field | Type | Description |
|---|---|---|
case.connector.id |
keyword | ID of the case's connector. Also includes .name and .type. |
case.external_service.connector_name |
keyword | Name of the external system the case was pushed to, such as ServiceNow. |
case.external_service.external_id |
keyword | ID of the incident in the external system. |
case.external_service.external_title |
text | Title of the external incident. |
case.external_service.pushed_at |
date | When the case was last pushed externally. .pushed_by.* records who pushed it. |
| Field | Type | Description |
|---|---|---|
case.observables.<type> |
keyword | Observables grouped into a keyword array per type, such as case.observables.url and case.observables.ipv4. |
The .cases-activity index holds one document per case action, such as a status change, comment, or template change.
| Field | Type | Description |
|---|---|---|
@timestamp |
date | When the action occurred. |
space_id |
keyword | The space the action's case belongs to. |
owner |
keyword | The owning solution. |
case.id |
keyword | UUID of the case the action was performed on. Join key back to .cases. |
actor.username |
keyword | Who performed the action. Also includes .email, .full_name, and .profile_uid. |
action.type |
keyword | What was acted on, such as create_case, status, severity, comment, template, tags, assignees, or connector. |
action.verb |
keyword | The action verb, such as create, update, delete, or add. |
action.status_new |
keyword | The new status, on a status-change action. |
action.severity_new |
keyword | The new severity, on a severity-change action. |
action.tags_changed |
keyword | Tags added or removed, on a tag-change action. |
action.assignees_changed |
keyword | Assignee IDs added or removed, on an assignment action. |
action.connector_id_new |
keyword | New connector ID, on a connector-change action. |
action.attachment_reference_id |
keyword | ID of the attachment referenced by a comment or attachment action. Join key into .cases-attachments. |
action.payload_json |
wildcard | The full action payload as a JSON string. Query any sub-field with ES|QL. |
The .cases-attachments index holds one document per attachment, such as a comment, alert, file, dashboard, or visualization.
| Field | Type | Description |
|---|---|---|
@timestamp |
date | When Elasticsearch last wrote this document. |
space_id |
keyword | The space the attachment's case belongs to. |
owner |
keyword | The owning solution. |
case.id |
keyword | UUID of the case the attachment belongs to. Join key back to .cases. |
attachment.type |
keyword | Attachment kind, such as user (comment), alert, externalReference, persistableState, or dashboard. |
attachment.attachment_id |
keyword | Referenced entity IDs, such as alert IDs or the saved object ID of an attached dashboard. |
attachment.comment |
text | Comment text for comment attachments. Also indexed as .keyword. |
attachment.alert.rule.id |
keyword | Rule ID for alert attachments. Also includes attachment.alert.rule.name. |
attachment.alert.indices |
keyword | Indices the attached alerts came from. |
attachment.event.indices |
keyword | Indices for event attachments. |
attachment.data_json |
wildcard | The full attachment payload as a JSON string. For a dashboard attachment, this holds the serialized dashboard configuration. |
attachment.metadata_json |
wildcard | The full attachment metadata as a JSON string. |
created_at |
date | When the attachment was added. created_by.* records who added it. |
updated_at |
date | When the attachment was last edited. updated_by.* records who edited it. |
pushed_at |
date | When the attachment was pushed to an external service. pushed_by.* records who pushed it. |
The .cases-activity and .cases-attachments indices include dedicated fields for the most common values, and also store each full record as JSON:
action.payload_jsonholds the full case action payload.attachment.data_jsonholds the full attachment payload.attachment.metadata_jsonholds the full attachment metadata.
These JSON fields have no length limit. Query them with ES|QL to reach any detail that doesn't have its own field.