[Security][Cases][9.5 & Serverless] Documents case analytics for 9.5 and Serverless by nastasha-solomon · Pull Request #7557 · elastic/docs-content

nastasha-solomon · 2026-07-24T04:52:03Z

Summary

Fixes https://github.com/elastic/docs-content-internal/issues/1444.

Documents the case analytics experience for 9.5 and Serverless. Replaces the single "Cases as data" page with a short overview plus focused child pages for the indices, exploring and visualizing, querying with ES|QL, analyzing fields, a field reference, and administration. Read access to the analytics indices is now documented in the existing Control access to cases page instead of a standalone page.

Each shared page uses version tabs to cover both the 9.5/Serverless GA feature and the 9.2–9.4 technical preview. Because the two versions use different schemas (GA uses the .cases* indices with case.*-prefixed fields; preview uses per-space .internal.cases.* indices with unprefixed fields), every version tab states its index and field conventions inline so the distinction is clear even out of context. Redirects preserve the old links.

Previews

Overview

Page name	Changes	File
Case analytics (new)	Overview explaining what case analytics is, how Elastic mirrors case data into analytics indices, and the value it offers. Folds the 9.2–9.4 turn-on step into a version-tagged dropdown and points readers to the explore, query, access, and administration pages.	explore-analyze/cases/case-analytics.md

Explore and query case data

Page name	Changes	File
Explore and visualize (new)	Covers the managed Case Analytics data view (GA) and manual data views (preview) for Discover and Lens, with a Next steps link to the ES\|QL page.	explore-analyze/cases/explore-case-data.md
Query with ES\|QL (new)	Sample ES\|QL queries for metrics like case volume, closure rates, and MTTR, split by version with explicit index and field-prefix guidance in each tab.	explore-analyze/cases/query-case-data-esql.md
Analyze fields (new)	Decision table plus three methods (typed fields, FIELD_EXTRACT, terms aggregation) for analyzing template and custom field values, using one consistent running example. GA/Serverless only.	explore-analyze/cases/analyze-case-fields.md

Reference and administration

Page name	Changes	File
Indices (new)	Reference for the analytics indices and how often they refresh, with a scannable "what it holds / example" table and version tabs for the GA `.cases` indices and preview `.internal.` indices.	explore-analyze/cases/case-analytics-indices.md
Field reference (new)	Catalog of the most useful fields across the three indices, plus the JSON payload fields. Notes date formatting and clarifies the `owner`, `case.id`, assignee, and custom field entries. GA/Serverless only.	explore-analyze/cases/case-analytics-fields.md
Administer (new)	Documents the internal admin routes for checking health, forcing updates, and rebuilding the indices, organized into task-based sections with a deployment-wide reset warning. GA only.	explore-analyze/cases/administer-case-analytics.md

Access, navigation, and redirects

Page name	Changes	File
Control access to cases (updated)	Added a Give access to the case analytics indices section covering the required Elasticsearch `read` and `view_index_metadata` privileges, with an example role and version tabs for 9.5/Serverless GA and the 9.2–9.4 preview, plus a matching row in the privileges quick reference.	explore-analyze/cases/control-case-access.md
Search and share cases (updated)	Minor copy edit.	explore-analyze/cases/search-share-cases.md
Cases as data (removed)	Deleted the single preview page; its content now lives across the new pages above.	explore-analyze/cases/cases-as-data.md
Table of contents	Added the case analytics overview with its child pages in reading order.	explore-analyze/toc.yml
Redirects	Mapped the old cases-as-data page and its anchors to the new pages, including the analytics index privileges anchor to the Control access page.	redirects.yml

Generative AI disclosure

Did you use a generative AI (GenAI) tool to assist in creating this contribution?

Yes - Cursor + Claude
No

github-actions · 2026-07-24T04:52:37Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

github-actions · 2026-07-24T04:56:20Z

🔍 Preview links for changed docs

github-actions · 2026-07-24T04:56:21Z

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
explore-analyze/cases/case-analytics-indices.md	65	Elastic.Spelling	'unprefixed' is a possible misspelling.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

melissaburpo

This looks great @nastasha-solomon!

Co-authored-by: Cursor <cursoragent@cursor.com> # Conflicts: # explore-analyze/cases/cases-as-data.md # explore-analyze/toc.yml

michaelolo24 · 2026-07-28T03:14:43Z

+| `POST /internal/cases/_analyticsV2/reset` | Requires `enableAdminRoutes: true` | Rebuilds all three indices and their data sources from your current cases |
+
+::::{warning}
+One set of case analytics indices serves the entire deployment across all spaces. These operations affect **all spaces**, not only the space you run them from. For example, running `reset` from any space rebuilds the analytics data and the **Case Analytics** {{data-source}} for every space. Plan a reset as a deployment-wide operation.


I'm not sure if it's really important to note, but this task will run batched in the background and will not disrupt any of the active case activity going on. Apart from maybe adding that, this looks great!

michaelolo24

Thank you!

michaelolo24 · 2026-07-28T03:25:07Z

+
+## Use typed fields in Discover and Lens [analyze-case-fields-typed]
+
+A typed field is a version of a case field that the managed Case Analytics {{data-source}} publishes with a specific data type, named `case.<name>_as_<type>` (for example, `case.effort_as_integer`). The {{data-source}} publishes one for each templated or global field. Because a typed field has a real type, you get numeric, date, and boolean operators in Discover and Lens instead of text matching on the raw value stored in `case.extended_fields`.


It may be helpful to note here. The underlying .cases analytic index has these fields actually mapped at case.extended_fields.<name>_as_<type>. On the concrete index extended_fields is mapped as a flattened field type, so every field nested in there... all of the <name>_as_<type> fields are technically keyword. As part of the Cases Analytics dataview, we do two things:

We create a runtime field on the Cases Analytics dataview where we map the field to it's typed version based on the _as_<type>. That type is sourced from the type defined for the field in the new cases templates system.

Also only in the Cases Analytics dataview, for ease of access, we lift the fields up a level from case.extended_fields.<name>_as_<type> => case.<name>_as_<type>. This is purely for convenience specifically in the data view

first draft

ea168f1

nastasha-solomon self-assigned this Jul 24, 2026

nastasha-solomon and others added 2 commits July 24, 2026 00:54

front matter

6434788

Merge branch 'main' into issue-1444

843e1f9

github-actions Bot deployed to docs-preview July 24, 2026 04:58 View deployment

Adding var

344459a

github-actions Bot deployed to docs-preview July 24, 2026 05:20 View deployment

Merge branch 'main' into issue-1444

e0e3571

github-actions Bot deployed to docs-preview July 24, 2026 17:58 View deployment

remove incorrect sentence

11d0af9

nastasha-solomon marked this pull request as ready for review July 24, 2026 18:38

nastasha-solomon requested review from a team as code owners July 24, 2026 18:38

nastasha-solomon requested review from melissaburpo and michaelolo24 July 24, 2026 18:38

github-actions Bot deployed to docs-preview July 24, 2026 18:42 View deployment

nastasha-solomon changed the title ~~Documents case analytics for 9.5 and Serverless~~ [Security][Cases][9.5 & Serverless] Documents case analytics for 9.5 and Serverless Jul 24, 2026

melissaburpo approved these changes Jul 24, 2026

View reviewed changes

nastasha-solomon added 3 commits July 27, 2026 22:12

Merge remote-tracking branch 'origin/main' into issue-1444

ee6ecf9

Co-authored-by: Cursor <cursoragent@cursor.com> # Conflicts: # explore-analyze/cases/cases-as-data.md # explore-analyze/toc.yml

remove versioning

f263c36

remove versioning text

7b0f345

github-actions Bot deployed to docs-preview July 28, 2026 02:20 View deployment

move case analytics priv docs

b0a7fa4

github-actions Bot deployed to docs-preview July 28, 2026 02:42 View deployment

small adjustments

ba77453

github-actions Bot deployed to docs-preview July 28, 2026 03:13 View deployment

fix link

93a7861

michaelolo24 reviewed Jul 28, 2026

View reviewed changes

michaelolo24 approved these changes Jul 28, 2026

View reviewed changes

github-actions Bot deployed to docs-preview July 28, 2026 03:17 View deployment

michaelolo24 reviewed Jul 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Security][Cases][9.5 & Serverless] Documents case analytics for 9.5 and Serverless - #7557

[Security][Cases][9.5 & Serverless] Documents case analytics for 9.5 and Serverless#7557
nastasha-solomon wants to merge 12 commits into
mainfrom
issue-1444

nastasha-solomon commented Jul 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 24, 2026

Uh oh!

github-actions Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 24, 2026

Uh oh!

melissaburpo left a comment

Uh oh!

michaelolo24 Jul 28, 2026

Uh oh!

michaelolo24 left a comment

Uh oh!

michaelolo24 Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		## Use typed fields in Discover and Lens [analyze-case-fields-typed]

		A typed field is a version of a case field that the managed Case Analytics {{data-source}} publishes with a specific data type, named `case.<name>_as_<type>` (for example, `case.effort_as_integer`). The {{data-source}} publishes one for each templated or global field. Because a typed field has a real type, you get numeric, date, and boolean operators in Discover and Lens instead of text matching on the raw value stored in `case.extended_fields`.

Uh oh!

Conversation

nastasha-solomon commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Previews

Overview

Explore and query case data

Reference and administration

Access, navigation, and redirects

Generative AI disclosure

Uh oh!

github-actions Bot commented Jul 24, 2026

Elastic Docs AI PR menu

Uh oh!

github-actions Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Jul 24, 2026

Elastic Docs Style Checker (Vale)

Uh oh!

melissaburpo left a comment

Choose a reason for hiding this comment

Uh oh!

michaelolo24 Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

michaelolo24 left a comment

Choose a reason for hiding this comment

Uh oh!

michaelolo24 Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nastasha-solomon commented Jul 24, 2026 •

edited

Loading

github-actions Bot commented Jul 24, 2026 •

edited

Loading