---
title: Case analytics field reference
description: Look up the fields in the case analytics indices, including case, activity, and attachment fields and the JSON payload fields.
url: https://www.elastic.co/elastic/docs-builder/docs/3739/explore-analyze/cases/case-analytics-fields
products:
- Elastic Cloud Enterprise
- Elastic Cloud Hosted
- Elastic Cloud Serverless
- Elastic Cloud on Kubernetes
- Elastic Stack
- Kibana
applies_to:
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Planned
---
# Case analytics field reference
Use this page as a reference for the fields you can query in the [case analytics indices](https://www.elastic.co/elastic/docs-builder/docs/3739/explore-analyze/cases/case-analytics-indices) when you're looking for specific case data.
Most fields use the singular `case.*` prefix, such as `case.status`, even though the index names are plural, such as `.cases`. A few fields, including `owner`, `space_id`, and `@timestamp`, sit at the top level without the `case.*` prefix.
Fields with the `date` type use ISO 8601 format, set to the server's time zone, such as `2025-07-27T14:30:00.000Z`.
## General case data (`.cases`)
The `.cases` index holds one document per case, with the current state of each case.
### Identity
| Field | Type | Description |
|-----------------------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `@timestamp` | date | When Elasticsearch last wrote this document, which tracks the case's last update. |
| `space_id` | keyword | The space the case belongs to. |
| `owner` | keyword | The solution that owns the case: `securitySolution` for Elastic Security, `observability` for Observability, or `cases` for Stack Management (unavailable in Serverless). |
| `case.id` | keyword | The case UUID. Join key for the activity and attachment indices. For more information, refer to [UUID](/elastic/docs-builder/docs/3739/explore-analyze/cases/search-share-cases#case-identifiers). |
| `case.incremental_id` | unsigned_long | The sequential case number shown in the UI. For more information, refer to [numeric ID](/elastic/docs-builder/docs/3739/explore-analyze/cases/search-share-cases#case-identifiers). |
### Core attributes
| Field | Type | Description |
|----------------------|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `case.title` | text | Case title. Also indexed as `case.title.keyword` for aggregation and sorting. |
| `case.description` | text | Case description. |
| `case.tags` | keyword | Tags applied to the case. |
| `case.category` | keyword | Case category. |
| `case.status` | keyword | Case status: `open`, `in-progress`, or `closed`. |
| `case.severity` | keyword | Case severity: `low`, `medium`, `high`, or `critical`. |
| `case.assignees.uid` | keyword | Profile UIDs of the case's assignees (a case can have several), not display names. To resolve a UID to a name, look it up with the [user profile API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-user-profile), or match it to `actor.profile_uid` in `.cases-activity`, which also carries `actor.username`, `.full_name`, and `.email`. The `.cases-activity` method only resolves users who have acted on a case. |
### Timestamps and timing metrics
Timing fields store values in seconds and are `null` until the case reaches the corresponding state. Divide by `3600` for hours.
| Field | Type | Description |
|----------------------------|---------------|------------------------------------------------------------------|
| `case.created_at` | date | When the case was created. |
| `case.updated_at` | date | When the case was last updated. |
| `case.in_progress_at` | date | When the case first moved to `in-progress`. |
| `case.closed_at` | date | When the case was closed. `null` while the case is open. |
| `case.duration` | unsigned_long | Total time from open to closed, in seconds. |
| `case.time_to_acknowledge` | long | Time from creation to first moving to `in-progress`, in seconds. |
| `case.time_to_investigate` | long | Time from `in-progress` to resolution, in seconds. |
| `case.time_to_resolve` | long | Time from creation to resolution, in seconds. |
### People
| Field | Type | Description |
|----------------------------|---------|-------------------------------------------------------------------------------------------------------|
| `case.created_by.username` | keyword | Username of the case creator. Also includes `.email`, `.full_name`, and `.profile_uid`. |
| `case.updated_by.username` | keyword | Username of the last editor. Also includes `.email`, `.full_name`, and `.profile_uid`. |
| `case.closed_by.username` | keyword | Username of the person who closed the case. Also includes `.email`, `.full_name`, and `.profile_uid`. |
### Counters
| Field | Type | Description |
|--------------------------|---------|----------------------------------------|
| `case.total_alerts` | integer | Number of alerts attached to the case. |
| `case.total_comments` | integer | Number of user comments on the case. |
| `case.total_events` | integer | Number of attached events. |
| `case.total_observables` | integer | Number of observables on the case. |
### Template and case fields
| Field | Type | Description |
|---------------------------|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `case.template.id` | keyword | ID of the template applied when the case was created, if any. |
| `case.template.version` | integer | Version of the applied template. |
| `case.extended_fields` | flattened | Template field values, keyed as `_as_`. Query the keys with `FIELD_EXTRACT` or a `terms` aggregation. Refer to [Analyze case fields](https://www.elastic.co/elastic/docs-builder/docs/3739/explore-analyze/cases/analyze-case-fields). |
| `case.customFields.key` | keyword | Key of a custom field. Paired with `.type` and `.value`. |
| `case.customFields.type` | keyword | The custom field's type. |
| `case.customFields.value` | keyword | The custom field's value, with typed sub-fields `.boolean`, `.date`, `.ip`, `.number`, and `.string`. |
`case.customFields` holds a case's custom field values in raw form and is populated for current cases. Because it's a `nested` field, you can't query it with ES|QL. Use Query DSL `nested` queries and aggregations instead. For values defined by a template or the field library, use `case.extended_fields`, which supports ES|QL and typed fields. Refer to [Analyze case fields](https://www.elastic.co/elastic/docs-builder/docs/3739/explore-analyze/cases/analyze-case-fields).
### Connector and external service
| Field | Type | Description |
|----------------------------------------|---------|---------------------------------------------------------------------------------|
| `case.connector.id` | keyword | ID of the case's connector. Also includes `.name` and `.type`. |
| `case.external_service.connector_name` | keyword | Name of the external system the case was pushed to, such as ServiceNow. |
| `case.external_service.external_id` | keyword | ID of the incident in the external system. |
| `case.external_service.external_title` | text | Title of the external incident. |
| `case.external_service.pushed_at` | date | When the case was last pushed externally. `.pushed_by.*` records who pushed it. |
### Observables
| Field | Type | Description |
|---------------------------|---------|----------------------------------------------------------------------------------------------------------------|
| `case.observables.` | keyword | Observables grouped into a keyword array per type, such as `case.observables.url` and `case.observables.ipv4`. |
## Case activity (`.cases-activity`)
The `.cases-activity` index holds one document per case action, such as a status change, comment, or template change.
| Field | Type | Description |
|----------------------------------|----------|-----------------------------------------------------------------------------------------------------------------------------|
| `@timestamp` | date | When the action occurred. |
| `space_id` | keyword | The space the action's case belongs to. |
| `owner` | keyword | The owning solution. |
| `case.id` | keyword | UUID of the case the action was performed on. Join key back to `.cases`. |
| `actor.username` | keyword | Who performed the action. Also includes `.email`, `.full_name`, and `.profile_uid`. |
| `action.type` | keyword | What was acted on, such as `create_case`, `status`, `severity`, `comment`, `template`, `tags`, `assignees`, or `connector`. |
| `action.verb` | keyword | The action verb, such as `create`, `update`, `delete`, or `add`. |
| `action.status_new` | keyword | The new status, on a status-change action. |
| `action.severity_new` | keyword | The new severity, on a severity-change action. |
| `action.tags_changed` | keyword | Tags added or removed, on a tag-change action. |
| `action.assignees_changed` | keyword | Assignee IDs added or removed, on an assignment action. |
| `action.connector_id_new` | keyword | New connector ID, on a connector-change action. |
| `action.attachment_reference_id` | keyword | ID of the attachment referenced by a comment or attachment action. Join key into `.cases-attachments`. |
| `action.payload_json` | wildcard | The full action payload as a JSON string. Query any sub-field with ES|QL. |
## Case attachments (`.cases-attachments`)
The `.cases-attachments` index holds one document per attachment, such as a comment, alert, file, dashboard, or visualization.
| Field | Type | Description |
|----------------------------|----------|------------------------------------------------------------------------------------------------------------------------------|
| `@timestamp` | date | When Elasticsearch last wrote this document. |
| `space_id` | keyword | The space the attachment's case belongs to. |
| `owner` | keyword | The owning solution. |
| `case.id` | keyword | UUID of the case the attachment belongs to. Join key back to `.cases`. |
| `attachment.type` | keyword | Attachment kind, such as `user` (comment), `alert`, `externalReference`, `persistableState`, or `dashboard`. |
| `attachment.attachment_id` | keyword | Referenced entity IDs, such as alert IDs or the saved object ID of an attached dashboard. |
| `attachment.comment` | text | Comment text for comment attachments. Also indexed as `.keyword`. |
| `attachment.alert.rule.id` | keyword | Rule ID for alert attachments. Also includes `attachment.alert.rule.name`. |
| `attachment.alert.indices` | keyword | Indices the attached alerts came from. |
| `attachment.event.indices` | keyword | Indices for event attachments. |
| `attachment.data_json` | wildcard | The full attachment payload as a JSON string. For a dashboard attachment, this holds the serialized dashboard configuration. |
| `attachment.metadata_json` | wildcard | The full attachment metadata as a JSON string. |
| `created_at` | date | When the attachment was added. `created_by.*` records who added it. |
| `updated_at` | date | When the attachment was last edited. `updated_by.*` records who edited it. |
| `pushed_at` | date | When the attachment was pushed to an external service. `pushed_by.*` records who pushed it. |
## JSON payload fields
The `.cases-activity` and `.cases-attachments` indices include dedicated fields for the most common values, and also store each full record as JSON:
- `action.payload_json` holds the full case action payload.
- `attachment.data_json` holds the full attachment payload.
- `attachment.metadata_json` holds the full attachment metadata.
These JSON fields have no length limit. Query them with ES|QL to reach any detail that doesn't have its own field.