- Kibana Guide: other versions:
- What is Kibana?
- What’s new in 8.3
- Kibana concepts
- Quick start
- Set up
- Install Kibana
- Configure Kibana
- Alerting and action settings
- APM settings
- Banners settings
- Enterprise Search settings
- Fleet settings
- i18n settings
- Logging settings
- Logs settings
- Metrics settings
- Monitoring settings
- Reporting settings
- Search sessions settings
- Secure settings
- Security settings
- Spaces settings
- Task Manager settings
- Telemetry settings
- URL drilldown settings
- Start and stop Kibana
- Access Kibana
- Securing access to Kibana
- Add data
- Upgrade Kibana
- Configure security
- Configure reporting
- Configure logging
- Configure monitoring
- Command line tools
- Production considerations
- Discover
- Dashboard and visualizations
- Canvas
- Maps
- Build a map to compare metrics by country or region
- Track, visualize, and alert on assets in real time
- Map custom regions with reverse geocoding
- Heat map layer
- Tile layer
- Vector layer
- Plot big data
- Search geographic data
- Configure map settings
- Connect to Elastic Maps Service
- Import geospatial data
- Troubleshoot
- Reporting and sharing
- Machine learning
- Graph
- Alerting
- Observability
- APM
- Security
- Dev Tools
- Fleet
- Osquery
- Stack Monitoring
- Stack Management
- REST API
- Get features API
- Kibana spaces APIs
- Kibana role management APIs
- User session management APIs
- Saved objects APIs
- Data views API
- Index patterns APIs
- Alerting APIs
- Action and connector APIs
- Cases APIs
- Import and export dashboard APIs
- Logstash configuration management APIs
- Machine learning APIs
- Short URLs APIs
- Get Task Manager health
- Upgrade assistant APIs
- Kibana plugins
- Troubleshooting
- Accessibility
- Release notes
- Developer guide
Open and manage cases
editOpen and manage cases
editThis functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Open a new case
editOpen a new case to keep track of issues and share their details with colleagues.
- Go to Management > Stack Management > Cases, then click Create case.
-
Give the case a name, add any relevant tags and a description.
In the
Description
area, you can use Markdown syntax to create formatted text. - For External incident management system, select a connector. For more information, refer to Add connectors.
- After you’ve completed all of the required fields, click Create case.
Add a visualization
editAfter you create a case, you can optionally add a visualization. For example, you can portray event and alert data through charts and graphs.

To add a visualization to a comment within your case:
- Click the Visualization button. The Add visualization dialog appears.
-
Select an existing visualization from your Visualize Library or create a new visualization.
Set an absolute time range for your visualization. This ensures your visualization doesn’t change over time after you save it to your case and provides important context for viewers.
- After you’ve finished creating your visualization, click Save and return to go back to your case.
- Click Preview to see how the visualization will appear in the case comment.
- Click Add Comment to add the visualization to your case.
After a visualization has been added to a case, you can modify or interact with it by clicking the Open Visualization option in the comment menu.
Manage cases
editIn Management > Stack Management > Cases, you can search cases and filter them by tags, reporter.
To view a case, click on its name. You can then:
- Add a new comment.
- Edit existing comments and the description.
- Add a connector.
- Send updates to external systems (if external connections are configured).
- Edit tags.
- Refresh the case to retrieve the latest updates.
- Change the status.
- Close or delete the case.
- Reopen a closed case.
On this page