Create an alerts index

Base URL: https://{kibana_url}

POST /api/detection_engine/index
POST /s/{space_id}/api/detection_engine/index

Auth

Creates an index for Elastic Security alerts. Calling this API is not required for the detection engine to function properly. You can create rules and alerts without calling this API.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Responses

Successful response

application/json

acknowledged boolean required

Unsuccessful authentication response

application/json

error string required
message string required
statusCode integer required

Not enough permissions response

application/json

message string required
status_code integer required

Not found

application/json

message string required
status_code integer required

Internal server error response

application/json

message string required
status_code integer required

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/index

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/index" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "acknowledged": true
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "API [POST /api/detection_engine/index] is unauthorized for the current user. The user must be able to create indices for the Elastic Security solution.",
  "status_code": 403
}

{
  "message": "A prerequisite resource required to create the alerts index was not found.",
  "status_code": 404
}

{
  "message": "Internal Server Error",
  "status_code": 500
}