Retrieve the status of detection alert migrations

deprecated

Base URL: https://{kibana_url}

GET /api/detection_engine/signals/migration_status
GET /s/{space_id}/api/detection_engine/signals/migration_status

Refer to Spaces for more information.

DEPRECATED. This endpoint was used for historical .siem-signals-* index migration workflows. Do not use for new automations; there is no supported replacement in this public API. WARNING: Prefer upgrading through supported Elastic stack upgrades rather than ad-hoc index migrations.

Retrieves indices that contain detection alerts of a particular age, along with migration information for each of those indices.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

Responses

Successful response

application/json

Invalid input data response

application/json

Unsuccessful authentication response

application/json

Internal server error response

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/detection_engine/signals/migration_status?from=now-30d

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/detection_engine/signals/migration_status?from=now-30d" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "indices": [
    {
      "index": ".siem-signals-default-000002",
      "is_outdated": true,
      "migrations": [
        {
          "id": "924f7c50-505f-11eb-ae0a-3fa2e626a51d",
          "status": "pending",
          "updated": "2021-01-06T20:41:37.173Z",
          "version": 16
        }
      ],
      "signal_versions": [
        {
          "count": 100,
          "version": 15
        },
        {
          "count": 87,
          "version": 16
        }
      ],
      "version": 15
    },
    {
      "index": ".siem-signals-default-000003",
      "is_outdated": false,
      "migrations": [],
      "signal_versions": [
        {
          "count": 54,
          "version": 16
        }
      ],
      "version": 16
    }
  ]
}

{
  "error": "Bad Request",
  "message": "[request query].from: expected date-math, received null",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}