Delete an alerts index
Base URL
https://{kibana_url}
DELETE
/api/detection_engine/index
Auth
Permanently deletes the Elastic Security alerts backing index in the current space, including the alerts
stored in it. Use with caution; prefer lifecycle policies or the UI when available.
Call GET /api/detection_engine/index first to confirm the index that will be removed.
Expand all
acknowledged
boolean required
401
Unsuccessful authentication response
application/json
statusCode
integer required
403
Not enough permissions response
application/json
status_code
integer required
404
Index does not exist response
application/json
status_code
integer required
500
Internal server error response
application/json
status_code
integer required
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Request
Console
1 / 2 languages
‹
›
1
DELETE kbn:/api/detection_engine/index
Generated from the API spec
1
2
curl -X DELETE "${KIBANA_URL}/api/detection_engine/index" \
-H "Authorization: ApiKey ${API_KEY}"
Generated from the API spec
Response
1
2
3
{
"acknowledged": true
}
1
2
3
4
5
{
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
1
2
3
4
{
"message": "API [DELETE /api/detection_engine/index] is unauthorized for the current user. The user needs alerts management permissions for the space.",
"status_code": 403
}
1
2
3
4
{
"message": "The Elastic Security alerts index to delete was not found.",
"status_code": 404
}
1
2
3
4
{
"message": "Internal Server Error",
"status_code": 500
}