Retrieve the status of detection alert migrations

deprecated

Server: https://{kibana_url}

GET /api/detection_engine/signals/migration_status
GET /s/{space_id}/api/detection_engine/signals/migration_status

Refer to Spaces for more information.

DEPRECATED. This endpoint was used for historical .siem-signals-* index migration workflows. Do not use for new automations; there is no supported replacement in this public API. WARNING: Prefer upgrading through supported Elastic stack upgrades rather than ad-hoc index migrations.

Retrieves indices that contain detection alerts of a particular age, along with migration information for each of those indices.

Query Parameters

from string required: Maximum age of qualifying detection alerts

Responses

Successful response

application/json

Invalid input data response

application/json

Unsuccessful authentication response

application/json

Internal server error response

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET /api/detection_engine/signals/migration_status?from={from}

curl Shell

curl -X GET "https://{kibana_url}/api/detection_engine/signals/migration_status?from={from}"

Response

{
  "indices": [
    {
      "index": ".siem-signals-default-000002",
      "is_outdated": true,
      "migrations": [
        {
          "id": "924f7c50-505f-11eb-ae0a-3fa2e626a51d",
          "status": "pending",
          "updated": "2021-01-06T20:41:37.173Z",
          "version": 16
        }
      ],
      "signal_versions": [
        {
          "count": 100,
          "version": 15
        },
        {
          "count": 87,
          "version": 16
        }
      ],
      "version": 15
    },
    {
      "index": ".siem-signals-default-000003",
      "is_outdated": false,
      "migrations": [],
      "signal_versions": [
        {
          "count": 54,
          "version": 16
        }
      ],
      "version": 16
    }
  ]
}

{
  "error": "Bad Request",
  "message": "[request query].from: expected date-math, received null",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}