Summary
PR #269581 introduces Cases As Data V2, an opt-in (feature flag xpack.cases.analyticsV2.enabled) rearchitecture of the cases analytics backend. V2 creates three hidden Elasticsearch indices (.cases, .cases-activity, .cases-attachments) using document-level security instead of per-space namespaced indices. This PR ships the first index (.cases) along with a managed 'Cases Analytics' data view that includes space-scoped runtime fields derived from case templates. V1 is unaffected and will be removed in a follow-up PR. Three internal admin API endpoints are also introduced, two gated behind a separate feature flag.
Why this needs docs: The existing Cases as Data docs describe the V1 index architecture (per-solution, per-space namespaced indices, xpack.cases.analytics.index.enabled); V2 uses a fundamentally different index structure and configuration key and the docs will be misleading once V2 ships as the default.
Resources
- PR #269581 — [Cases][Cases As Data V2] - Introduce Cases As Data V2
Availability
| Channel |
Details |
| Stack |
v9.5.0 |
| Serverless |
Jul 6–Jul 10 |
| Feature flag |
xpack.cases.analyticsV2.enabled |
Created with Docs Quest Scanner by @nastasha-solomon
Suggested edits
Use cases as data > Enable cases as data
- What the docs say: The page describes enabling the feature with xpack.cases.analytics.index.enabled: true, creating a data view pointing to .internal.cases* indices, and per-solution/per-space index naming (.internal.cases.<solution>-<space-name>).
- What to add: A new V2 architecture is introduced behind the xpack.cases.analyticsV2.enabled flag. Unlike V1, V2 uses three global hidden indices (.cases, .cases-activity, .cases-attachments) with document-level security for space isolation. A managed 'Cases Analytics' data view is created automatically per-space and includes runtime fields from case templates. The existing enable/configure steps and index-naming explanation will need a V2 counterpart or replacement section once V2 becomes the default. The kibana.yml knob and index pattern differences should be documented. Applies from 9.5.0 (stateful only, behind feature flag; serverless availability to be confirmed).
Case analytics indices schema > Index schema reference
- What the docs say: The page documents the fields available in V1 case analytics indices across four categories (case data, comments, attachments, activity) with per-solution/per-space naming.
- What to add: V2 introduces a new .cases index with updated field mappings, dynamic templates for extended fields, and space-scoped runtime fields on the managed data view. A V2 schema reference (or a versioned addendum) is needed documenting the new index names and field structure. Applies from 9.5.0 (stateful only, behind feature flag).
Summary
PR #269581 introduces Cases As Data V2, an opt-in (feature flag xpack.cases.analyticsV2.enabled) rearchitecture of the cases analytics backend. V2 creates three hidden Elasticsearch indices (.cases, .cases-activity, .cases-attachments) using document-level security instead of per-space namespaced indices. This PR ships the first index (.cases) along with a managed 'Cases Analytics' data view that includes space-scoped runtime fields derived from case templates. V1 is unaffected and will be removed in a follow-up PR. Three internal admin API endpoints are also introduced, two gated behind a separate feature flag.
Why this needs docs: The existing Cases as Data docs describe the V1 index architecture (per-solution, per-space namespaced indices, xpack.cases.analytics.index.enabled); V2 uses a fundamentally different index structure and configuration key and the docs will be misleading once V2 ships as the default.
Resources
Availability
Created with Docs Quest Scanner by @nastasha-solomon
Suggested edits
Use cases as data > Enable cases as data
Case analytics indices schema > Index schema reference