---
title: Case analytics indices
description: Reference for the case analytics indices that store case data, covering how they're organized and how often they refresh.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/cases/case-analytics-indices
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Stack
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Preview from 9.2 to 9.4
---

# Case analytics indices
Elastic mirrors your case data into dedicated analytics indices that are built for reporting and aggregation. This page describes those indices and how often they refresh. To let users report on this data, [grant access to the case analytics indices](/elastic/docs-content/tree/main/explore-analyze/cases/control-case-access#give-analytics-access).

## Indices

<applies-switch>
  <applies-item title="{ "stack": "ga 9.5", "serverless": "ga" }" applies-to="Elastic Cloud Serverless: Generally available, Elastic Stack: Planned">
    Elasticsearch automatically creates three analytics indices and keeps them in sync with your case data:

    | Index                | What it holds                                           | Example                                              |
    |----------------------|---------------------------------------------------------|------------------------------------------------------|
    | `.cases`             | One document per case, with each case's current details | Status, severity, assignees, and timing metrics      |
    | `.cases-activity`    | One document per action taken on a case                 | A status change, severity change, or comment         |
    | `.cases-attachments` | One document per item attached to a case                | An alert, comment, file, dashboard, or visualization |
    The `.cases-activity` and `.cases-attachments` indices join back to `.cases` on the `case.id` field.These indices store status and severity as readable text and precalculate common timing metrics like time to resolve. They hold data from Elastic Security, Observability, and Stack Management together, so use the `owner` and `space_id` fields to filter by solution or space.
    <important>
      Field names use the singular `case.*` form, such as `case.status`. A plural path like `cases.status` isn't a valid field, and the ES|QL query fails.
    </important>
    For the fields available in each index, refer to [Case analytics field reference](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/cases/case-analytics-fields).
  </applies-item>

  <applies-item title="stack: preview 9.2-9.4" applies-to="Elastic Stack: Preview from 9.2 to 9.4">
    Elasticsearch automatically creates the analytics indices for you, so you don't need to create them or manage their lifecycle policies. It creates a separate set of indices for each solution in every space that has cases.Elasticsearch names each index `.internal.<type>.<solution>-<space-name>`, with a matching alias that drops the `.internal` prefix. For example, Security case attachments in the `default` space use the index `.internal.cases-attachments.securitysolution-default` and the alias `.cases-attachments.securitysolution-default`.Combine a type and a solution to build the name for the data you want:

    | `<type>`            | Contents          |
    |---------------------|-------------------|
    | `cases`             | General case data |
    | `cases-comments`    | Case comments     |
    | `cases-attachments` | Case attachments  |
    | `cases-activity`    | Case activity     |


    | Solution         | `<solution>`       |
    |------------------|--------------------|
    | Stack Management | `cases`            |
    | Observability    | `observability`    |
    | Security         | `securitysolution` |

    <important>
      In Elastic Stack 9.2.x-9.4.x, fields are unprefixed. For example, use `status` and `time_to_resolve`, not `case.status`. This differs from 9.5 and later, where fields use the `case.*` prefix.
    </important>
    For schema details, refer to [Case analytics indices schema](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/case-analytics-indices-schema).
  </applies-item>
</applies-switch>


## Data freshness

<applies-switch>
  <applies-item title="{ "stack": "ga 9.5", "serverless": "ga" }" applies-to="Elastic Cloud Serverless: Generally available, Elastic Stack: Planned">
    Case analytics keeps your data current in two ways:
    1. It updates the indices as soon as you create, edit, or delete a case.
    2. As a backup, a background task checks for recently changed cases on a regular schedule (about every 30 minutes) and fills in anything the immediate update missed.
    Because updates take a moment to apply, a new or edited case can take a short time to appear in your queries.
  </applies-item>

  <applies-item title="stack: preview 9.2-9.4" applies-to="Elastic Stack: Preview from 9.2 to 9.4">
    A background task refreshes the analytics indices every five minutes with a snapshot of the most current case data. During each refresh, Elasticsearch overwrites the historical case data.
    <note>
      - After you create a case, indexing the new case data can take up to 10 minutes.
      - After you create a space, the case analytics indices for that space can take up to an hour to form.
    </note>
  </applies-item>
</applies-switch>