Finalize detection alert migrations

Base URL: https://{kibana_url}

POST /api/detection_engine/signals/finalize_migration

Auth Deprecated

DEPRECATED. Completes a legacy alert index migration. Do not automate against this in new code. WARNING: Finalizing swaps read aliases; confirm the migration has finished successfully before calling.

Finalize successful migrations of detection alerts. This replaces the original index's alias with the successfully migrated index's alias. The endpoint is idempotent, so you can poll until a migration finishes and then call this operation once.

Request body

Array of migration_ids to finalize

migration_ids string[] · min items: 1 required: Array of migration_ids to finalize.

Responses

Successful response

application/json

<array> object[]

Invalid input data response

application/json

Unsuccessful authentication response

application/json

Internal server error response

application/json

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/signals/finalize_migration
{
  "migration_ids": [
    "924f7c50-505f-11eb-ae0a-3fa2e626a51d"
  ]
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/signals/finalize_migration" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "migration_ids": [
      "924f7c50-505f-11eb-ae0a-3fa2e626a51d"
    ]
  }'

Generated from the API spec

Response

{
  "migrations": [
    {
      "completed": true,
      "destinationIndex": ".siem-signals-default-000002-r000016",
      "id": "924f7c50-505f-11eb-ae0a-3fa2e626a51d",
      "sourceIndex": ".siem-signals-default-000002",
      "status": "success",
      "updated": "2021-01-06T22:05:56.859Z",
      "version": 16
    }
  ]
}

{
  "error": "Bad Request",
  "message": "[request body].migration_ids: at least one migration id is required to finalize",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request body { }

Responses

Request body