Delete an alerts index

Server: https://{kibana_url}

DELETE /api/detection_engine/index
DELETE /s/{space_id}/api/detection_engine/index

Refer to Spaces for more information.

Permanently deletes the Elastic Security alerts backing index in the current space, including the alerts stored in it. Use with caution; prefer lifecycle policies or the UI when available. Call GET /api/detection_engine/index first to confirm the index that will be removed.

Responses

Successful response

application/json

Unsuccessful authentication response

application/json

Not enough permissions response

application/json

Index does not exist response

application/json

Internal server error response

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

DELETE /api/detection_engine/index

curl Shell

curl -X DELETE "https://{kibana_url}/api/detection_engine/index"

Response

{
  "acknowledged": true
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "API [DELETE /api/detection_engine/index] is unauthorized for the current user. The user needs alerts management permissions for the space.",
  "status_code": 403
}

{
  "message": "The Elastic Security alerts index to delete was not found.",
  "status_code": 404
}

{
  "message": "Internal Server Error",
  "status_code": 500
}