Create an alerts index

Server: https://{kibana_url}

POST /api/detection_engine/index
POST /s/{space_id}/api/detection_engine/index

Refer to Spaces for more information.

Creates an index for Elastic Security alerts. Calling this API is not required for the detection engine to function properly. You can create rules and alerts without calling this API.

Responses

Successful response

application/json

Unsuccessful authentication response

application/json

Not enough permissions response

application/json

Not found

application/json

Internal server error response

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/detection_engine/index

curl Shell

curl -X POST "https://{kibana_url}/api/detection_engine/index"

Response

{
  "acknowledged": true
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "API [POST /api/detection_engine/index] is unauthorized for the current user. The user must be able to create indices for the Elastic Security solution.",
  "status_code": 403
}

{
  "message": "A prerequisite resource required to create the alerts index was not found.",
  "status_code": 404
}

{
  "message": "Internal Server Error",
  "status_code": 500
}