Skip to content

[ResponseOps][Cases][9.2 & Serverless] New case analytics indices feature docs #2220

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 28 commits into
base: main
Choose a base branch
from
Open

[ResponseOps][Cases][9.2 & Serverless] New case analytics indices feature docs #2220

wants to merge 28 commits into from

Conversation

nastasha-solomon
Copy link
Contributor

@nastasha-solomon nastasha-solomon commented Jul 22, 2025 •
edited
Loading

⚠️ NOTE: Must be merged after elastic/kibana#229036. ⚠️

Contributes to #1716 by documenting how to visualize case data using the new case analytics indices.

Preview:

  • Visualize case data: New page
  • Stack cases: Added note letting users know that it's possible to to visualize data from cases in your space. Also added a limitations section to better highlight feature limits that users need to be aware of.
  • Observability cases - Added note letting users know that it's possible to to visualize data from cases in your space. Also added a limitations section and updated it so it matches what's included in other case docs.
  • Security cases - Same changes as above.

@nastasha-solomon nastasha-solomon self-assigned this Jul 22, 2025
@github-actions GitHub Actions
Copy link

github-actions bot commented Jul 22, 2025 •
edited
Loading

🔍 Preview links for changed docs

@nastasha-solomon nastasha-solomon mentioned this pull request Jul 22, 2025
Draft
nastasha-solomon
nastasha-solomon commented Jul 22, 2025
View reviewed changes
explore-analyze/alerts-cases/cases/visualize-case-data.md Outdated
Case analytics indices and their aliases are automatically generated when Kibana starts up. Every five minutes, the indices are updated with new data from cases in your space. Historical data about cases is not stored; it gets overwritten whenever new case data is written to the indices.

You can begin querying case analytics indices as soon as you have cases in your space. To learn more about fields in the indices, refer to
% [Case analytics indices schema](kibana://reference/case-analytics-indices-schema.md)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will uncomment this ref once I merge elastic/kibana#229036.

@nastasha-solomon nastasha-solomon marked this pull request as ready for review July 22, 2025 22:55
@nastasha-solomon nastasha-solomon requested review from a team as code owners July 22, 2025 22:55
@nastasha-solomon nastasha-solomon mentioned this pull request Jul 22, 2025
Closed
@nastasha-solomon nastasha-solomon changed the title [ResponseOps][Cases][9.1 & Serverless] New case analytics indices [ResponseOps][Cases][9.1 & Serverless] New case analytics indices feature docs Jul 22, 2025
@nastasha-solomon nastasha-solomon changed the title [ResponseOps][Cases][9.1 & Serverless] New case analytics indices feature docs [ResponseOps][Cases][9.2 & Serverless] New case analytics indices feature docs Sep 3, 2025
janmonschke
janmonschke reviewed Sep 22, 2025
View reviewed changes
janmonschke
janmonschke reviewed Sep 22, 2025
View reviewed changes
janmonschke
janmonschke reviewed Sep 22, 2025
View reviewed changes
@nastasha-solomon
Copy link
Contributor Author

Notes to self:

  • Need to add subscription requirement for Stack
  • Need to doc feature flag - xpack.cases.analytics.index.enabled: true and also notify them to be wary of enabling flag if have lots of spaces (12 indices per space are created -- no way to limit number of indices created per space atm).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tiamliu tiamliu tiamliu left review comments

@mdbirnstiehl mdbirnstiehl mdbirnstiehl approved these changes

@adcoelho adcoelho Awaiting requested review from adcoelho

@janmonschke janmonschke Awaiting requested review from janmonschke

Assignees

@nastasha-solomon nastasha-solomon

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@nastasha-solomon @janmonschke @tiamliu @mdbirnstiehl