The most straightforward and scalable way would be to have an index of data modeled separately. Here, instead of an index of raw events, having a caseId centric index would make this an easy aggregation.
The caseId index would use case_id as the _id for the ES docs. When events come in, update the case document by ID and it will have the latest status.
The table then becomes an aggregation of each status keyword, and the count of documents in the case index that have that status.