Delete an alerts index

Base URL: https://{kibana_url}

DELETE /api/detection_engine/index

Permanently deletes the Elastic Security alerts backing index in the current space, including the alerts stored in it. Use with caution; prefer lifecycle policies or the UI when available. Call GET /api/detection_engine/index first to confirm the index that will be removed.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Responses

Successful response

application/json

Unsuccessful authentication response

application/json

Not enough permissions response

application/json

Index does not exist response

application/json

Internal server error response

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

DELETE kbn:/api/detection_engine/index

Generated from the API spec

curl Shell

curl -X DELETE "${KIBANA_URL}/api/detection_engine/index" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "acknowledged": true
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "API [DELETE /api/detection_engine/index] is unauthorized for the current user. The user needs alerts management permissions for the space.",
  "status_code": 403
}

{
  "message": "The Elastic Security alerts index to delete was not found.",
  "status_code": 404
}

{
  "message": "Internal Server Error",
  "status_code": 500
}