Initiate a detection alert migration

deprecated

Server: https://{kibana_url}

POST /api/detection_engine/signals/migration

DEPRECATED. Legacy API for on-demand reindexing of old .siem-signals-* alert indices. Do not build new integrations; upgrade the Elastic Stack and rely on product-managed data lifecycle instead. WARNING: Migrations can be resource intensive and should be planned during a maintenance window.

Initiate a migration of detection alerts. Migrations are initiated per index. The process is not destructive and should not remove existing data, but it can consume significant cluster resources. Plan capacity accordingly.

Request

Responses

Successful response

application/json

Invalid input data response

application/json

Unsuccessful authentication response

application/json

Internal server error response

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/detection_engine/signals/migration
{
  "index": [
    ".siem-signals-default-000001"
  ]
}

curl Shell

curl -X POST "https://{kibana_url}/api/detection_engine/signals/migration" \
  -H "Content-Type: application/json" \
  -d '{
  "index": [
    ".siem-signals-default-000001"
  ]
}'

Response

{
  "indices": [
    {
      "index": ".siem-signals-default-000001,",
      "migration_id": "923f7c50-505f-11eb-ae0a-3fa2e626a51d",
      "migration_index": ".siem-signals-default-000001-r000016"
    }
  ]
}

{
  "error": "Bad Request",
  "message": "[request body].index: at least one index name is required to start a migration",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request { index , requests_per_second , size , slices , }

Responses

Request